--- title: "WordPress Security Checklist: Is Your Website Secure?" description: You might think your website is safe due to the sheer number of sites online but security by obscurity isn't a good solution. image: https://blog.envisionitsolutions.com/hubfs/wordpress-security-checklist---is-your-website-secure.jpg --- [![EnvisionIT Solutions Blog Logo](https://blog.envisionitsolutions.com/hubfs/eits%20blog%20logo.svg "EnvisionIT Solutions Blog Logo")](https://blog.envisionitsolutions.com/) - Blog Topics - [IT Security](https://blog.envisionitsolutions.com/topic/it-security) - [VoIP Phones](https://blog.envisionitsolutions.com/topic/voip-phones) - [IT Outsourcing](https://blog.envisionitsolutions.com/topic/it-outsourcing) - [Business Continuity](https://blog.envisionitsolutions.com/topic/business-continuity) - [Tech Tips](https://blog.envisionitsolutions.com/topic/tech-tips) - [Cloud Tech](https://blog.envisionitsolutions.com/topic/cloud-tech) - [Web Design](https://blog.envisionitsolutions.com/topic/web-design) - [Website Security](https://blog.envisionitsolutions.com/topic/website-security) - [Web Tips](https://blog.envisionitsolutions.com/topic/web-tips) - [SEO](https://blog.envisionitsolutions.com/topic/seo) - [Marketing](https://blog.envisionitsolutions.com/topic/marketing) - [Graphic Design](https://blog.envisionitsolutions.com/topic/graphic-design) - [⚲ Search](https://blog.envisionitsolutions.com/search) - ¦ - [IT Support](http://www.envisionitsolutions.com/it-services/) - [Business Continuity](https://www.envisionitsolutions.com/business-continuity/) - [VoIP Phones](https://www.envisionitsolutions.com/voip-select/) - [Web Design](http://www.envisionitsolutions.com/website-design/) [☰](https://blog.envisionitsolutions.com/wordpress-security-checklist-is-your-website-secure#mobile) - [Tech Tips](https://blog.envisionitsolutions.com/topic/tech-tips) - [Business Technology](https://blog.envisionitsolutions.com/topic/business-technology) - [IT Outsourcing](https://blog.envisionitsolutions.com/topic/it-outsourcing) - [General IT](https://blog.envisionitsolutions.com/topic/general-it) ## [Is Your Technology Helping Your Team - or Holding Them Back?](https://blog.envisionitsolutions.com/is-your-technology-helping-your-team-or-holding-them-back) **Cody Osborn** | Jul 6, 2026 8:39:14 AM   - [Website Security](https://blog.envisionitsolutions.com/topic/website-security) ### [WordPress Security Checklist: Is Your Website Secure?](https://blog.envisionitsolutions.com/wordpress-security-checklist-is-your-website-secure) - - - [Back to posts](https://blog.envisionitsolutions.com) # February 25, 2020 # WordPress Security Checklist: Is Your Website Secure? # WordPress Security Checklist: Is Your Website Secure? ![wordpress-security-checklist---is-your-website-secure](https://blog.envisionitsolutions.com/hs-fs/hubfs/wordpress-security-checklist---is-your-website-secure.jpg?width=650&name=wordpress-security-checklist---is-your-website-secure.jpg)Over a [third of the web](https://wordpress.org/) uses WordPress to power their website. That's a lot of sites and a big target for hackers and other threats.   You might think your website is safe due to the sheer number of sites online but **security by obscurity** isn't a good solution. Let's go through a WordPress security checklist that will help keep your site secure from attacks.   ## Why Would a Hacker Care About Your Site? It doesn't matter how big or small your site is or how large your audience is, if you're running WordPress, it's attractive to hackers. If they get access to your site they can use it as a spamming proxy, for distributing malware, or to initiate attacks against your hosting service. [![website redesign](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/345825/078919da-690f-4783-9f4f-ca11f50bc3ab.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/345825/078919da-690f-4783-9f4f-ca11f50bc3ab)   Hackers run search scripts that scour the internet looking for WordPress-based sites. When they find them, they'll probe for thousands of [known vulnerabilities](https://www.cvedetails.com/vulnerability-list.php?vendor_id=2337&product_id=4096&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=287&sha=f7e9f236634d1e8f8f1588d8b60868d41a0af790). If your site is vulnerable, it's an easy target.   ## Keep WordPress Up-to-Date One of the simplest but most important security tips is to keep WordPress and other components of your website updated. Like Windows and macOS, WordPress gets updated regularly to add features, fix bugs, and patch security problems. Keeping up to date means you'll be at risk for fewer vulnerabilities.   Related Post: [Why Wordpress Websites Get Hacked](https://blog.envisionitsolutions.com/why-wordpress-websites-get-hacked) [![why-wordpress-websites-get-hacked](https://blog.envisionitsolutions.com/hs-fs/hubfs/blog-image-files/why-wordpress-websites-get-hacked.jpg?width=550&name=why-wordpress-websites-get-hacked.jpg)](https://blog.envisionitsolutions.com/why-wordpress-websites-get-hacked)   It's not just WordPress though. Make sure you keep any plugins and themes installed on your site up-to-date as well. These components can also pose security risks, even if WordPress itself is fully updated. Delete any inactive plugins and themes as well. Even if they're not active, they can still pose security risks.   ## Use Strong Passwords All users on your site should use [strong passwords](https://blog.envisionitsolutions.com/how-to-create-a-password-and-policy-thats-nearly-unbreakable), especially any administrators. Use a minimum of 12 characters and a combination of upper and lower case text, numbers, and symbols. Stay away from obvious things like "password" and even less obvious words found in a dictionary.   Brute force attacks can run thousands of passwords through your site in minutes so if your password is a common word, it's much more likely to get uncovered.   ## Install an SSL Certificate You should install an SSL certificate on your WordPress site so it works with the https protocol. This supports end-to-end encryption so everything you send to the site gets encrypted.   If you aren't using SSL, your password and other information you send to the site can be intercepted by anyone with the necessary skills. This is especially important if you log into your site on public WiFi networks where anyone could be sniffing the data.   ## Change the Default Admin Username Most WordPress sites use the default "admin" username for the site administrator. This makes an easy target for brute force attacks.   Change the username to something unique (**administrator** isn't much better) so hackers won't have an easy vector into your website.   ## Beyond this Security Checklist This WordPress security checklist is a good starting point but there are plenty of other things you can do to secure your site even further. You can install a security plugin like [Wordfence](https://www.wordfence.com/) or [Sucuri](https://sucuri.net/) as well as a good backup plugin so you have an up-to-date copy of your website if something does go wrong.   And check out our other [website security](https://blog.envisionitsolutions.com/topic/website-security) posts for more helpful information, both for WordPress and other types of sites. ![Mike Tungate](https://blog.envisionitsolutions.com/hubfs/mike-author.jpg) ###### ABOUT THE AUTHOR | Mike Tungate Hello! I am the Web Services Manager @ EnvisionIT Solutions. I create business websites, help shape a businesses image through branding, and help them grow through content marketing. I am an avid photographer and a lover of musical instruments. Find me on: --- #### Subscribe to our newsletter [Subscribe Now](https://www.envisionitsolutions.com/newsletter-signup/) [![21-questions](https://blog.envisionitsolutions.com/hs-fs/hubfs/2018%20Image%20Files/21-questions.png?width=258&name=21-questions.png "21-questions")](http://info.envisionitsolutions.com/21-questions) #### **21 Questions To Ask Before Hiring An Honest, Competent, Responsive, Fairly-Priced Computer Consultant** Don’t trust your company’s critical data and operations to just anyone! This business advisory guide will arm you with 21 Revealing Questions you should ask any computer consultant before giving them access to your network. [![21 Questions](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/345825/875e0f03-dd2e-4a6c-bb51-e8304bc2cc94.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/345825/875e0f03-dd2e-4a6c-bb51-e8304bc2cc94) [![2017-logo circle](https://blog.envisionitsolutions.com/hubfs/2017-logo%20circle.svg "2017-logo circle")](http://www.envisionitsolutions.com) #### Find Your Way - Blog Topics - [⚲ Search](https://blog.envisionitsolutions.com/search) - ¦ - [IT Support](http://www.envisionitsolutions.com/it-services/) - [Business Continuity](https://www.envisionitsolutions.com/business-continuity/) - [VoIP Phones](https://www.envisionitsolutions.com/voip-select/) - [Web Design](http://www.envisionitsolutions.com/website-design/) ## Contact Us 7500 Jefferson St. NE Albuquerque, NM 87109 505-823-3400 #### Keep in Touch ### Subscribe to Our Blog © 2026 EnvisionIT Solutions